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Of the 590 information technology (IT) investments reviewed, GAO identified 12 
potentially duplicative investments at three key federal agencies — namely, the 
Departments of Homeland Security (DHS), Defense (DOD), and Health and 
Human Services (HHS). These investments accounted for about $321 million in 
reported IT spending for fiscal years 2008 through 2013. Of the 12 investments 
(as shown in the table below), GAO identified: 

• two potentially duplicative investments at DHS that support immigration 
enforcement booking management, which includes the processing of 
apprehended illegal aliens suspected of committing criminal violations of 
immigration law; 

• four such investments at DOD, which include two investments that track 
health care status of warfighters, with one since having been canceled, and 
two investments that manage dental care; and 

• six potentially duplicative investments at HHS, which include four 
investments that support enterprise information security and two for Medicare 
coverage determination. 



Potentially Duplicative Investments by Agency and Investment Purpose 


Dollars in millions 


Agency 


Purpose 


Number of 
investments 


Planned and reported 
spending fiscal years 
2008 -2013 


DHS 


Immigration Enforcement Booking 
Management 


2 


$ 30.27 


DOD 


Health Care Tracking System 


2 


15.79 




Dental Management 


2 


14.81 


HHS 


Enterprise Information Security 


4 


256.59 




Medicare Coverage Determination 


2 


3.79 


Total 




12 


$321.25 



Source: GAO analysis. 

DHS officials said having the two immigration booking investments were due in 
part to one component agency's unique requirements but were unable to provide 
analysis showing why one system could not satisfy the unique requirements. 
DOD officials recognized that the investments GAO identified were duplicative 
and have canceled one of the health care systems and intend to consolidate the 
dental systems by 2015 but had not developed a plan on how this was to be 
accomplished. HHS officials disagreed that its information security investments 
were duplicative but nonetheless plan to review them by September 2013 to 
identify opportunities for consolidation. Regarding the Medicare coverage 
determination investments, HHS officials noted that they have consolidated 
several functions but could not provide documented justification for why the other 
functions were not consolidated. By addressing these duplications, the agencies 
will be able to provide assurance they are avoiding investing in unnecessary 
systems and thus saving resources. 
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CBP 


U. S. Customs and Border Protection 


DHS 


Department of Homeland Security 


DOD 


Department of Defense 


FEA 


Federal Enterprise Architecture 
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Department of Health and Human Services 
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U. S. Immigration and Customs Enforcement 


IT 


information technology 


OMB 


Office of Management and Budget 
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441 G St. N.W. 
Washington, DC 20548 



U.S. GOVERNMENT ACCOUNTABILITY OFFICE 



September 12, 2013 
Congressional Requesters 

Federal agencies currently report spending more than $82 billion annually 
on information technology (IT). Given the magnitude of this investment, it 
is important that federal agencies avoid investing in duplicative 
investments, whenever possible, to ensure the most efficient use of 
resources. As a result, the Office of Management and Budget (OMB) 
requires federal agencies to report on their IT investments, including 
identifying the primary functions of each investment using OMB-defined 
categories — such as information and technology management, supply 
chain management, and human resource management. 

In prior work analyzing agency investments within the aforementioned 
three OMB categories, we reported in February 2012 that agencies, such 
as the Departments of Defense and Energy, were funding investments 
that perform similar functions, thus raising concern that these agencies 
were investing in unnecessary systems. 1 Accordingly, we recommended 
that the agencies, among other things, address these potentially 
duplicative investments, and the agencies generally agreed with our 
recommendations. 

At your request, this report provides the results of our review to identify 
the extent to which potentially duplicative IT investments exist within other 
OMB categories (e.g., defense and national security, health, and 
homeland security) at those key agencies that reportedly spend the most 
on IT. 2 Specifically, our objective was to identify whether there are 
potentially duplicative IT investments at these key federal agencies. To do 
this, we first selected for review the three agencies with the largest 
amount of planned IT spending — namely, the Departments of Homeland 
Security (DHS), Defense (DOD), and Health and Human Services (HHS). 



GAO, Information Technology: Departments of Defense and Energy Need to Address 
Potentially Duplicative Investments, GAO-12-241 (Washington, D.C.: Feb. 17, 2012). 

2 For the purposes of our analysis, we considered "duplication" to occur when two or more 
agencies or programs are engaged in the same activities or provide the same services to 
the same beneficiaries. 
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To identify potentially duplicative IT investments at these agencies, we (1) 
reviewed key OMB budgetary data to identify investments that were 
performing similar functions and (2) analyzed investment documentation 
and interviewed agency officials to assess whether such investments 
were duplicative and could be consolidated or eliminated. Specifically, we 
assessed investment data from an OMB document — called the exhibit 
53 — which summarizes each agency's annual planned (budgeted) IT 
investment spending and grouped individual investments at a high level 
by their primary functions and in a more detailed manner by 
subfunctions. 3 We then selected for each agency, the two primary 
functions detailed on the exhibit 53 that had the largest amount of 
spending planned for fiscal year 2012. Within each function category, we 
further chose the two subfunction categories with the largest planned 
spending. 4 As a result of this analysis, we identified 590 investments, with 
total planned spending of $15.3 billion for fiscal year 2012, to be 
reviewed. The primary and subfunction categories selected for each of 
the three agencies are as follows: 



Table 1: Selected Agencies, Primary Function, and Subfunctions Used to Select IT 
Investments 



Agency 


Primary function 


Subfunction 


DHS 


Disaster Management 


Disaster Preparedness and Planning 
Emergency Response 




Homeland Security 


Border and Transportation Security 

Key Asset and Critical Infrastructure 
Protection 


DOD 


Defense and National Security 


Battlespace Networks 
Command and Control 




Health 


Health Care Administration 





3 The exhibit 53 identifies all IT projects — both major and non-major — and their associated 
costs within a federal organization. Information included on agency exhibit 53s is 
designed, in part, to help OMB better understand what agencies are spending on IT 
investments. 



4 For DHS and DOD, we excluded from consideration those function and subfunction 
categories selected in our February 2012 report (GAO-1 2-241) on federal IT duplication. 
In that report, DOD and DHS were evaluated within the following primary categories: 
information and technology management, human resource management, and supply 
chain management. 
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Agency Primary function 



Subfunction 



Health Care Delivery Services 

HHS Health Population Health Management and 

Consumer Safety 

Health Care Administration 

Information and Technology IT Infrastructure Maintenance 
Management 

Information Security 

Source: GAO analysis of OMB budget documents. 

Note: Since the fiscal year 2004 budget cycle, OMB has required agencies to categorize their IT 
investments in their annual exhibit 53s according to primary function and subfunction. 

Further, within each subfunction category, we then reviewed the name 
and narrative description of each investment's mission purpose to identify 
similarities among related investments within each agency. 5 Once we 
identified investments that had such similarities, we grouped them by 
mission purpose into categories (referred to as purpose groups) — such as 
dental management and enterprise information security — that more 
specifically defined the purpose and mission of these similar investments. 

Next, we compared the investments within these groupings to identify 
those that performed similar or overlapping functions. We then discussed 
these investments with the appropriate agency officials, including whether 
the investments could be consolidated or eliminated, and obtained 
additional information on each investment. Further, to identify any actions 
agencies had taken to address the potentially duplicative investments we 
identified, we assessed agency documentation (e.g., agency 
memorandums, project plans) and interviewed officials. 

We conducted this performance audit from November 2012 to September 
2013 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for 
our findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our findings 
and conclusions based on our audit objective. See appendix I for a 
complete description of our objective, scope, and methodology. 



5 We did not review investments across agencies. 
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RarVcfrrYnnH Information technology should enable government to better serve the 

° American people. However, according to OMB, despite spending more 

than $600 billion on IT over the past decade, the federal government has 
achieved little of the productivity improvements that private industry has 
realized from IT. 6 



Too often, federal IT projects run over budget, behind schedule, fail to 
deliver promised functionality, or are duplicative of other projects. In 
combating this problem, proper oversight is critical. Both OMB and federal 
agencies have key roles and responsibilities for overseeing IT investment 
management. OMB is responsible for working with agencies to ensure 
investments are appropriately planned and justified. Additionally, each 
year, OMB and federal agencies work together to determine how much 
the government plans to spend on IT projects and how these funds are to 
be allocated. 



OMB uses the following mechanisms and processes, among others, to 
help it fulfill its required oversight responsibilities for federal IT spending. 

• Exhibit 53s and exhibits 300s. OMB requires 27 federal departments 
and agencies 7 to provide information related to their IT investments, 
including agency exhibit 53s and capital asset plans and business 
cases (called exhibit 300s). 8 

• Federal Enterprise Architecture (FEA) initiative. In February 2002, 
OMB established the FEA initiative. According to OMB, the FEA is 
intended to facilitate governmentwide improvement through cross- 



OMB, 25 Point Implementation Plan to Reform Federal Information Technology 
Management (Washington, D.C.: December 2010). 

7 The 27 agencies are the Agency for International Development; the Departments of 
Agriculture, Commerce, Defense, Education, Energy, Health and Human Services, 
Homeland Security, Housing and Urban Development, the Interior, Justice, Labor, State, 
Transportation, the Treasury, and Veterans Affairs; the Army Corps of Engineers; the 
Environmental Protection Agency; the General Services Administration; the National 
Aeronautics and Space Administration; the National Archives and Records Administration; 
the National Science Foundation; the Nuclear Regulatory Commission; the Office of 
Personnel Management; the Small Business Administration; the Smithsonian Institution; 
and the Social Security Administration. 

8 Exhibit 300s provide a business case for each major IT investment and allow OMB to 
monitor IT investments once they are funded. Agencies are required to provide 
information on each major investment's cost, schedule, and performance. 
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agency analysis and identification of duplicative investments, gaps, 
and opportunities for collaboration, interoperability, and integration 
within and across agency programs. The FEA is composed of five 
"reference models" describing the federal government's (1) business 
(or mission) processes and functions, independent of the agencies 
that perform them; (2) performance goals and outcome measures; (3) 
means of service delivery; (4) information and data definitions; and (5) 
technology standards. Since the fiscal year 2004 budget cycle, OMB 
has required agencies to categorize their IT investments in their 
annual exhibit 53s according to primary function and subfunction as 
identified in the FEA reference models. Additionally, agencies were 
required to choose a subfunction for each investment related to the 
primary function. 

• IT reform. In December 2010, the Federal Chief Information Officer 
issued a 25 Point Implementation Plan to Reform Federal Information 
Technology Management. This 18-month plan specified five major 
goals: strengthening program management, streamlining governance 
and improving accountability, increasing engagement with industry, 
aligning the acquisition and budget processes with the technology 
cycle, and applying "light technology" and shared solutions. As part of 
this plan, OMB outlined actions to, among other things, strengthen 
agencies' investment review boards and consolidate federal data 
centers. The plan stated that OMB will work with Congress to 
consolidate commodity IT spending (e.g., e-mail, data centers, 
content management systems, and web infrastructure) to, among 
other things, eliminate duplication, under agency Chief Information 
Officers. Further, the plan called for the role of agency Chief 
Information Officers to focus more on IT portfolio management. 

In April 2012, we reported on the federal government's progress 
toward implementing these actions. 9 In particular, we found that OMB 
and key federal agencies had made progress on action items in the IT 
Reform Plan, but that much work remained to be done on action items 
such as completing data center consolidation plans and launching a 
forum for agencies to share IT management best practices. 
Accordingly, we recommended, among other things, that the agencies 
complete all key IT Reform action items; OMB agreed with our 
recommendation. 



9 GAO, Information Technology Reform: Progress Made but Future Cloud Computing 
Efforts Should be Better Planned, GAO-12-756 (Washington, D.C.: July 11, 2012). 
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• IT operations and maintenance. With regard to identifying and 

eliminating duplication within existing IT legacy systems — commonly 
referred to as steady state investments — OMB issued the Capital 
Programming Guide that calls for agencies to analyze (via operational 
analysis) whether their steady state investments are continuing to 
meet business and customer needs and are contributing to meeting 
the agency's strategic goals. 10 More specifically, this guidance calls 
for agencies to perform operational analyses annually on each steady 
state investment and requires that each operational analysis address 
17 key factors, including cost, schedule, customer satisfaction, 
strategic and business results, financial goals, and whether the 
investment overlaps with other systems. 

In October 2012, we reported that of five key agencies selected for 
review, only two had performed operational analyses, and these two 
agencies did not perform analyses on all their steady state 
investments. 11 Further, of the analyses performed by the two 
agencies, none fully addressed the 17 key factors specified in OMB's 
guidance. Consequently, we recommended that the agencies conduct 
annual operational analyses on all their steady state investments and 
in doing, fully address the 17 key factors. The agencies agreed with 
our recommendations and have taken actions, such as developing 
operational analysis guidance, to address them. 

. PortfolioStat reviews. In March 2012, OMB launched the PortfolioStat 
initiative, which requires agencies to conduct an annual agencywide 
IT portfolio review to, among other things, reduce commodity IT 12 
spending and demonstrate how their IT investments align with the 
agency's mission and business functions. PortfolioStat is designed to 
assist agencies in assessing the current maturity of their IT 
investment management process, making decisions on eliminating 



10 OMB, Capital Programming Guide, Supplement to OMB Circular A-1 1 , Part 7 
(Washington, D.C.: July 2012). 

11 GAO, Information Technology: Agencies Need to Strengthen Oversight of Billions of 
Dollars in Operations and Maintenance Investments, GAO-13-87 (Washington, D.C.: Oct. 
16, 2012). 

12 According to OMB, commodity IT includes services such as IT infrastructure (data 
centers, networks, desktop computers and mobile devices); enterprise IT systems (e-mail, 
collaboration tools, identity and access management, security, and web infrastructure); 
and business systems (finance, human resources, and other administrative functions). 
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duplicative investments, and moving to shared solutions in order to 
maximize the return on IT investments across the portfolio. While 
OMB's TechStat reviews are intended to examine IT performance at 
the specific project or investment-level, PortfolioStat reviews are 
intended to examine the portfolio as a whole and draw on the 
agency's enterprise architecture to help identify and eliminate areas of 
duplication and waste. In March 2013, OMB reported that through its 
PortfolioStat effort, agencies had identified and committed to nearly 
100 opportunities to consolidate or eliminate commodity IT 
investments. OMB reports that PortfolioStat has the potential to save 
the government $2.5 billion over the next 3 years by, for example, 
consolidating duplicative systems. 



GAO Has Previously 
Reported on Potential IT 
Investment Duplication 



During the past several years, we have issued multiple reports and 
testimonies and made numerous recommendations to OMB and federal 
agencies to identify and reduce duplication within the federal 
government's portfolio of IT investments. 13 For example, in September 
201 1, we reported that results of OMB initiatives to identify potentially 
duplicative IT investments were mixed and that several federal agencies 
did not routinely assess their entire IT portfolios to identify and remove or 
consolidate duplicative systems. 14 Specifically, we found that most of 
OMB's recent initiatives had not yet demonstrated results, and several 
agencies had not routinely assessed legacy systems to determine if they 
were duplicative. Accordingly, we recommended that OMB among other 
things (1) improve its agency guidance on identifying and categorizing IT 
investments and (2) require the agencies as part of their annual budget 
and IT investment submissions to report the steps they take to ensure 
their IT investments are not duplicative. OMB generally agreed with these 
two recommendations and to address them subsequently updated its 



13 GAO-12-210; GAO-1 1-826; GAO-1 1-262; GAO-1 0-701; Information Technology: 
Management and Oversight of Projects Totaling Billions of Dollars Need Attention, 
GAO-09-624T (Washington, D.C.: Apr. 28, 2009); Information Technology: OMB and 
Agencies Need to Improve Planning, Management, and Oversight of Projects Totaling 
Billions of Dollars, GAO-08-1051T (Washington, D.C.: July 31, 2008); Information 
Technology: Further Improvements Needed to Identify and Oversee Poorly Planned and 
Performing Projects, GAO-07-1211T (Washington, D.C.: Sept. 20, 2007); Information 
Technology: Improvements Needed to More Accurately Identify and Better Oversee Risky 
Projects Totaling Billions of Dollars, GAO-06-1099T (Washington, D.C.: Sept. 7, 2006); 
Information Technology: Agencies and OMB Should Strengthen Processes for Identifying 
and Overseeing High Risk Projects, GAO-06-647 (Washington, D.C.: June 15, 2006). 

14 GAO-1 1-826. 
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guidance to provide additional clarity on how agencies should 
characterize investments in order to enhance the identification of 
potentially duplicative investments. 

In addition, in February 2012 we reported on potentially duplicative IT 
investments within DOD, the Department of Energy, and DHS. 15 
Specifically, we found that while DOD and the Department of Energy had 
various investment review processes in place that were partially designed 
to avoid investing in systems that were duplicative, we identified 37 
potentially duplicative investments, totaling about $1.2 billion for fiscal 
years 2007 through 2012. Accordingly, we recommended that the 
agencies utilize existing transparency mechanisms, such as the IT 
Dashboard, to report on the results of the department's efforts to identify 
and eliminate, where appropriate, each potentially duplicative investment 
we identified, as well as any other duplicative investments. We also 
recommended that these agencies, among other things, report on the 
progress of their efforts to identify and eliminate duplication. The agencies 
generally agreed with our recommendations and have taken steps to 
address them. For example, DOD and the Department of Energy (1) are 
conducting portfolio reviews, as part of their established IT investment 
management processes, as means to identifying and eliminating IT 
duplication and (2) plan to report the results of these reviews via the IT 
Dashboard. 

Most recently, we reported in April 2013 on the progress of federal 
agencies in reducing duplication and overlap in their IT data centers 
(defined as data storage facilities). 16 Specifically, we reported that 
although OMB's goal (as specified in its February 2010 Federal Data 
Center Consolidation Initiative to guide agencies in consolidating data 
centers) was to close 40 percent, or 1 ,253 of the 3,133 total federal data 
centers by the end of 2015, with estimated cost savings of $3 billion, 17 
nearly all of the agencies had yet to complete a data center inventory or 
related key plans essential to beginning consolidation. We also reported 



15 GAO-1 2-241. 

16 GAO, Data Center Consolidation: Strengthened Oversight Needed to Achieve Cost 
Savings Goal, GAO-1 3-378 (Washington, D.C.: Apr. 23, 2013). 

17 As of June 2013, the number of data centers being reported by agencies had grown to 
over 6,800 facilities — an increase of more than 3,600 facilities compared to OMB's 
previous estimate. 
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that while agencies had closed 420 data centers, this was 285 closures 
short of where OMB expected the agencies to be as of the December 
2012 time frame. Further, we found that OMB had not determined 
agencies' progress against their cost savings goals because OMB had 
yet to determine a consistent and repeatable method for tracking cost 
savings. Consequently, we recommended that OMB, among other things, 
track and report on key performance measures and extend the time frame 
for achieving planned cost savings. OMB agreed with the first 
recommendation and plans to evaluate the second recommendation but 
did not provide a time frame for the evaluation's completion. 
Additionally, the above work and associated reports have been updated 
and summarized in our 2011, 2012, and 2013 duplication series which 
reported on opportunities that existed for federal agencies to reduce 
fragmentation, overlap, or duplication in key areas, including IT, in order 
to achieve greater efficiency and effectiveness. 18 



A Small Number of 
the Agencies' IT 
Investments Appeared 
to be Potentially 
Duplicative, but They 
Represent Significant 
Spending 



The three agencies in our review had some IT investments that appeared 
to be duplicative; of the total investments we reviewed, the number of 
such investments was small but represented a significant amount of 
spending. Specifically, of the 590 IT investments reviewed, we identified 
12 potentially duplicative investments (within 5 purpose groups) at DHS, 
DOD, and HHS which accounted for about $321 million in reported IT 
spending for fiscal years 2008 through 2013. (Our analysis and 
categorization of the 12 investments by common purposes is included in 
app. II). With regard to the 12 investments, we found, as shown in table 2, 
the following: 

• two potentially duplicative investments totaling about $30 million at 
DHS that are used to "book" and process apprehended illegal aliens 
who are suspected of committing criminal and administrative 
violations, commonly referred to as immigration enforcement booking 
management; 

• four such investments totaling about $31 million at DOD, which 
include two investments totaling $16 million that track health care 



' a GAO-1 1-318SP; GAO, 2012 Annual Report: Opportunities to Reduce Duplication, 
Overlap and Fragmentation, Achieve Savings, and Enhance Revenue, GAO-12-342SP 
(Washington, D.C. Feb. 28, 2012); GAO, 2013 Annual Report: Actions Needed to Reduce 
Fragmentation, Overlap, and Duplication and Achieve Other Financial Benefits, 
GAO-13-279SP (Washington, D.C: Apr. 9, 2012). 
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status of warfighters and two investments totaling $15 million that 
manage dental care; and 

• six potentially duplicative investments totaling approximately $260 
million at HHS, which include four investments totaling $257 million 
that support enterprise information security and two totaling $4 million 
for Medicare Coverage Determination. 



Table 2: Number of Potentially Duplicative Investments Grouped by Purpose 


Dollars in millions 


Agency 


Purpose 


Number of 
investments 


Planned and reported 
spending fiscal years 
2008 -2013 


DHS 


1. Immigration Enforcement Booking 
Management 


2 


$ 30.27 


DOD 


2. Health Care Tracking System 


2 


15.79 




3. Dental Management 


2 


14.81 


HHS 


4. Enterprise Information Security 


4 


256.59 




5. Medicare Coverage Determination 


2 


3.79 


Total 


5 


12 


$321.25 



Source: GAO analysis. 



It is important that federal agencies avoid duplicative investments, 
whenever possible, to ensure the most efficient use of resources. As 
such, OMB has issued guidance to help agencies reduce duplicative IT 
investments. 19 More specifically, our analysis (by agency) found the 
following for each of the investments addressed in the purpose groups 
specified in table 2. 

DHS At DHS, the department had two potentially duplicative IT investments 

with the purpose of immigration enforcement booking; they are called E3 
and EAGLE and are used by DHS component agencies — namely, U.S. 
Customs and Border Protection (CBP) and U.S. Immigration and 
Customs Enforcement (ICE), respectively — to enforce immigration law, 
including the processing of apprehended illegal aliens who are suspected 
of committing criminal and administrative violations. These investments 



19 OMB, 25 Point Implementation Plan to Report Federal Information Technology 
Management (December 2010); OMB, Capital Programming Guide, Supplement to OMB 
Circular A-11, Part 7 (July 201 2). 
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were potentially duplicative because they perform similar functions, 
including 

• capturing biographic information on apprehended illegal aliens, 

• recording illegal alien arrests and enforcement incidents, 

• collecting biometric data on such aliens, and 

• querying other law enforcement data sources about, among other 
things, prior arrests and outstanding warrants. 

CBP and ICE officials disagreed that the investments are duplicative, and 
thus do not have plans to address them. Specifically, officials from CBP 
and ICE stated that E3 and EAGLE accommodate different work 
processes and requirements. For example, ICE officials stated that 
EAGLE is a customized interface designed to meet the needs of its 
investigative and detention mission. However, CBP and ICE officials 
agreed that the systems do capture common data elements that are 
stored in a single, shared database. 20 In addition, in 2007, CBP and ICE 
planned to jointly develop the E3 project. Specifically, according to the E3 
project charter (dated February 2007) and project plan (dated June 2007), 
the goal of the investment was to jointly develop a system to replace the 
then legacy booking management system being used at the time by both 
agencies. Although ICE subsequently withdrew from the project citing 
risks with the intended modernization approach and unique requirements 
that would not be addressed by the new system, it was not able to 
provide evidence corroborating its concerns with the modernization 
approach or an analysis showing that its requirements could not be 
satisfied by the new (E3) system. Further, as part of its development of 
EAGLE, ICE did assess three alternatives to the legacy booking 
management system, including E3 but concluded that adopting E3 also 
had significant cost and schedule risks. Nevertheless, ICE was not able to 
provide the costs associated with each of the alternatives other than 
EAGLE and thus could not corroborate their assessment that EAGLE was 
the most viable alternative. 

DOD At DOD, the department had two potentially duplicative investments in 

Health Care Tracking and two in Dental Management. Specifically, the 
two Health Care Tracking investments — namely, the Warrior Care and 
Transition System and Clinical Case Management Information 



E3 and EAGLE store data in the Enforcement Integrated Database — owned and 
operated by ICE. 
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Technology Initiative — manage wounded soldier health care through their 
transition back into active duty status or as veterans. DOD officials 
agreed that these investments had areas of duplication, and stated that 
they recently canceled the Clinical Case Management Information 
Technology Initiative, in part to address this duplication. 

The two dental management systems — called Corporate Dental 
Application and Dental Common Access System — support and service 
the oral health of operational personnel, including the collection and 
management of oral health data, and updating readiness. These 
investments were potentially duplicative because they perform similar 
functions for each of the armed services. 21 Department officials stated 
that when the systems were originally being deployed to the various 
armed services, the department did not consider deploying a common 
solution. Specifically, the Navy deployed its system in 2000 and the Army 
deployed its system in 1998 to meet their services' specific dental system 
requirements. 22 DOD officials agreed that these systems are potentially 
duplicative and said to address this duplication, the department plans to 
migrate to a single system across all armed services. DOD officials stated 
that they plan to complete this migration by fiscal year 201 7 and recently 
signed a memorandum of understanding (dated February 2013) on how 
they plan to share data between the systems until the migration is 
completed. In addition, according to these officials, DOD has developed a 
draft plan for how this migration is to be completed, but the plan has yet 
to be approved, and DOD was unable to provide us with documentation 
of this effort. 

HHS At HHS, the department had four potentially duplicative investments in 

Enterprise Information Security and two supporting Medicare Coverage. 
The four information security investments maintain and secure the 
operations and assets of HHS and its components. 23 These investments 



The Corporate Dental Application is used by the Army and Air Force, and the Navy uses 
the Dental Common Access System. 

22 The Air Force started transitioning to the Corporate Dental Application in 2003 and 
finalized this transition in 201 1 . 

23 The investments are: (1 ) Centers for Medicare and Medicaid Services - The Center for 
Consumer Information and Insurance Oversight Enterprise IT Security Program; (2) Indian 
Health Service - IT Security Program; (3) Health Resources and Services Administration 
- Office of Information Technology Federal Information Systems Security Program; and 
(4) HHS - Secure One. 
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were potentially duplicative because they had overlapping products and 
solutions which were procured separately to address similar requirements 
across HHS and its components. Department officials stated that, 
although the information security investments appear to be duplicative on 
the surface, these investments are not analogous to a system but, rather, 
fund information security functions, such as personnel, policy, and 
oversight for each component. Nonetheless, HHS officials stated that the 
department is currently conducting a review, to be completed by 
September 2013, to identify opportunities for consolidation of information 
security activities across its components. As part of this, officials said that 
HHS plans to use the Chief Information Security Officer council to gather 
uniform toolsets that can be used across the department to improve 
efficiencies. 

The two Medicare coverage management systems — which are called the 
National Coverage Determination and Local Coverage Determination 
databases — collect and disseminate information regarding Medicare 
coverage on national and local levels, as well as Medicare policy and 
other related information to the public via a website. These systems were 
potentially duplicative because they store and disseminate similar 
Medicare information to the public, but are maintained separately by the 
same contractor. Department officials stated that the department has 
consolidated certain functions of the systems, such as help desk 
functions and website management, to reduce duplication and create 
efficiencies. With regard to the other functions, the officials said that they 
determined that consolidating these functions would be more costly than 
keeping them separate, due to issues such as differences in mandated 
processes, security requirements and the size and complexity of the 
systems, but were not able to provide documentation showing this cost 
analysis. 



Conclusions ^° t ' ne crec '' t °^ ^HS, DOD, and HHS, the vast majority of the IT 

1 1 " ' jA investments examined did not appear to be duplicative. Nonetheless, 

those few identified as being potentially duplicative represent significant 
financial investments on behalf of these agencies and appeared in part to 
be unnecessary. In selected cases, DOD and HHS are acting to address 
and eliminate duplicative investments. In other instances, DHS, DOD, and 
HHS have not yet demonstrated evidence of plans to do so. As a result, 
the agencies cannot provide assurance they are not spending resources 
on duplicative investments. 
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To better ensure agencies avoid duplicative investments, we recommend 
that the Secretary of Homeland Security direct appropriate officials to: 

• address the potentially duplicative investments identified in this report, 
including assessing the extent to which a single system could meet 
CBP and ICE immigration enforcement booking requirements. 

We recommend that the Secretary of Defense direct appropriate officials 
to: 

• develop and document a plan on how the department intends to 
migrate its single dental system solution to all the services. 

We recommend that the Secretary of Health and Human Services direct 
appropriate officials to: 

• assess whether it would be cost effective to consolidate the remaining 
functions of the Medicare coverage determination systems. 



Recommendations for 
Executive Action 



In commenting on a draft of this report, DOD and HHS agreed with our 
recommendations. Specifically, 

• In its written comments, DOD concurred with our recommendation. 
The department added that the Air Force and Army have already 
transitioned to the single dental system solution (the Corporate Dental 
Application). It also noted that the Navy is to do the same in fiscal 
year 2015 (with the exception of ship-based installations of the system 
which are not to be completed until fiscal year 201 7 due to the ships' 
limited availability for scheduling the installations). DOD's comments 
are reprinted in appendix III. 

• In comments provided via email from its GAO audit liaison within the 
Office of the Chief Information Officer, HHS also concurred with our 
recommendation. 

DHS, in its written comments — which are reprinted in appendix IV — stated 
it did not concur with our recommendation because the EAGLE and E3 
investments have been reviewed by the DHS Chief Enterprise Architect 
and have been through DHS's annual IT review processes and were 
found not to be duplicative. Specifically, DHS said that EAGLE and E3 
share the same database, and the applications that access it were 
developed separately to facilitate mission-specific functions for ICE and 
CBP agents. 



Agency Comments 
and Our Evaluation 
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While we recognize that ICE and CBP developed their applications 
separately to facilitate mission-specific functions, we also note that these 
applications perform similar functions, such as capturing biographic 
information on apprehended illegal aliens, recording illegal alien arrest 
and enforcement incidents, and collecting biometric data on such aliens. 
We also note (and discuss in the report) that ICE was unable to provide 
analyses showing, among other things, that its specific requirements 
could not be satisfied by the E3 system. Until such an assessment is 
performed, DHS cannot provide assurance that it is not spending 
resources on duplicative immigration enforcement investments. 

DOD, HHS, and DHS also provided technical comments, which we 
incorporated as appropriate. 



If you or your staff have any questions on the matters discussed in this 
report, please contact me at (202) 512-9286 or at pownerd@gao.gov. 
Contact points for our Offices of Congressional Relations and Public 
Affairs may be found on the last page of this report. GAO staff who made 
major contributions to this report are listed in appendix V. 

$«~/ a. /$L->_ 

David A. Powner 

Director, Information Technology 

Management Issues 
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List of Requesters 

The Honorable Thomas R. Carper 
Chairman 

The Honorable Tom Coburn, M.D. 
Ranking Member 

Committee on Homeland Security and Governmental Affairs 
United States Senate 

The Honorable Claire McCaskill 
Chairman 

Subcommittee on Financial and Contracting Oversight 
Committee on Homeland Security and Governmental Affairs 
United States Senate 

The Honorable Susan M. Collins 
United States Senate 
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Appendix I: Objective, Scope, and 
Methodology 



Our objective was to identify whether there are potentially duplicative 
information technology (IT) investments at key federal agencies. More 
specifically, it was to identify the extent to which potentially duplicative IT 
investments exist within Office of Management and Budget (OMB) 
defined categories — such as defense and national security; disaster 
management; health; and homeland security — at the key agencies that 
reportedly spend the most on IT. 1 To do this, we first selected for review 
the three agencies with the largest amount of planned IT spending during 
fiscal year 201 2 — namely, the Departments of Homeland Security (DHS), 
Defense (DOD), and Health and Human Services (HHS). 

To identify potentially duplicative IT investments at the agencies, we (1) 
reviewed key OMB budgetary data to identify investments that were 
performing similar functions and (2) analyzed investment documentation 
and interviewed agency officials to assess whether such investments 
were duplicative and could be consolidated or eliminated. Specifically, we 
assessed investment data from a key OMB document — called the Exhibit 
53 which summarizes each agency's annual planned (budgeted) IT 
investment spending and groups individual investments at a high level by 
Federal Enterprise Architecture (FEA) 2 primary functions and in a more 
detailed manner by FEA subfunctions. We then selected for each agency, 
the top two FEA primary functions detailed on the exhibit 53 that had the 
largest amount of spending planned for fiscal year 201 2. Within each 
function category we further chose the top two subfunction categories 
with the largest planned spending. 3 As a result of this analysis, we 
identified 590 investments, with total planned spending of $15.3 billion for 
fiscal year 2012, to be reviewed.The following table displays the 
agencies, primary FEA functions, and FEA subfunctions we selected. 



1 For the purposes of our analysis, we considered "duplication" to occur when two or more 
agencies or programs are engaged in the same activities or provide the same services to 
the same beneficiaries. 

2 The FEA is intended to provide federal agencies and other decision makers with a 
common frame of reference or taxonomy for informing agencies' individual enterprise 
architecture efforts and their planned and ongoing investment activities, and to do so in a 
way that identifies opportunities for avoiding duplication of effort and launching initiatives 
to establish and implement common, reusable, and interoperable solutions across agency 
boundaries. 

3 For DHS and DOD, we excluded from consideration those functions and subfunctions 
selected in our February 2012 report on potentially duplicative IT investments. 
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Appendix I: Objective, Scope, and 
Methodology 



Table 3: Selected Agencies, Primary FEA Function, and Subfunctions Used to 
Select IT Investments 



Agency FEA primary function FEA subfunction 

DHS Disaster Management Disaster Preparedness and Planning 

Emergency Response 

Homeland Security Border and Transportation Security 

Key Asset and Critical Infrastructure 
Protection 

DOD Defense and National Security Battlespace Networks 

Command and Control 

Health Health Care Administration 

Health Care Delivery Services 

HHS Health Population Health Management and 

Consumer Safety 

Health Care Administration 

Information and Technology IT Infrastructure Maintenance 

Management Information Security 

Source: GAO analysis of OMB budget documents. 

Note: Since the fiscal year 2004 budget cycle, OMB has required agencies to categorize their IT 
investments in their annual exhibit 53s according to primary function and subfunction as identified in 
the FEA reference models. Additionally, agencies were required to choose a subfunction for each 
investment related to the primary function. 

This nongeneralizable sample of 590 IT investments was 8 percent of the 
7,272 investments agencies reported on their exhibit 53s. The investments 
we reviewed represented approximately 10 percent of DOD's IT portfolio 
in terms of number of investments that it reports to OMB, 31 percent of 
HHS's, and 33 percent of DHS's. 

Within each subfunction, we then reviewed the name and narrative 
description of each investment's purpose to identify similarities among 
related investments within each agency. 4 Once we identified investments 
that had such similarities, we grouped them by mission purpose into 
categories (we described as purpose groups) — such as dental 
management and enterprise information security — that more specifically 
defined the purpose and mission of these similar investments. 



4 We did not review investments across agencies. 
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Appendix I: Objective, Scope, and 
Methodology 



Next, we compared the investments within these groupings to identify 
those that performed similar or overlapping functions. We then discussed 
these investments with the appropriate agency officials, including whether 
the investments could be consolidated or eliminated, and obtained 
additional information on each investment. This included reviewing and 
assessing agencies' rationales for having multiple systems that perform 
similar functions. Further, to identify any actions agencies had taken to 
address the potentially duplicative investments we identified, we 
assessed agency documentation (e.g., agency memorandums, project 
plans) and interviewed officials. We also interviewed agency officials to 
identify the actions taken to consolidate, eliminate, or modify such 
investments. 

We conducted this performance audit from November 2012 to September 
2013 in accordance with generally accepted government auditing 
standards. Those standards required that we plan and perform the audit 
to obtain sufficient, appropriate evidence to provide a reasonable basis 
for our findings and conclusions based on our audit objectives. We 
believe that the evidence obtained provides a reasonable basis for our 
findings and conclusions based on our audit objective. 
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Appendix II: Additional Information on 
Potentially Duplicative Investments 



Table 4 provides information on the 12 potentially duplicative IT 
investments at DHS, DOD, and HHS we identified as potentially 
duplicative within the selected FEA categories (e.g., Health, Homeland 
Security, and Information and Technology Management). 



Table 4: Potentially Duplicative Investments at DHS, DOD, and HHS 



Agency Similar purpose 



Component/bureau 
investment title 



Description 



FEA category 



Planned and 
reported 
spending 
fiscal years 
2008-2013 
(in millions) 



DHS 



Immigration 
Enforcement 
Booking 
Management 



CBP- E3 



E3 is designed to support agents and 
officers during intelligence, 
apprehension, prosecution, and 
enforcement activities with modules for 
processing arrests, assaults, and 
biometrics. 



Homeland 
Security 



$23.60 



Immigration 
Enforcement 
Booking 
Management 



ICE - EAGLE 



EAGLE is designed to provide, among 
other things, an alien processing and 
booking system that supports criminal 
and other arrests with faster processing 
times and improved biometrics 
collection. It is also designed to (1) 
operate over wireless connections and 
(2) integrate with other ICE applications. 



Homeland 
Security 



6.67 



DOD Health Care 

Tracking System 



DOD-wide - Army 
Warrior Care and 
Transition System 



Army Warrior Care and Transition 
System is to provide the Army's Warrior 
Transition Units and Community Based 
Warrior Transition Units with a 
standardized IT capability to manage 
and track Warriors in Transition. 



Health 



6.84 



Health Care 
Tracking System 



DOD-wide - Clinical 
Case Management 
Information Technology 
Initiative 



This investment is to provide IT 
capabilities to support the capture and 
use of data to enhance the seamless 
transition of the recovering service 
member through the continuum of care. 



Health 



8.95 



Dental Management DOD-wide - Corporate 
Dental Application 



The Corporate Dental Application is a 
database of the oral health status for 
active duty soldiers within the Army. It is 
a clinical scheduling system to be used 
by health care providers to enter their 
workload/procedure treatment codes, 
and it updates dental readiness. 



Health 



9.82 



Dental Management 



DOD-wide - Dental 
Common Access 
System 



The Dental Common Access System is 
a Navy Medical data management 
system that is to collect and manage 
dental data via a web-based repository. 



Health 



4.99 
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Appendix II: Additional Information on 
Potentially Duplicative Investments 



Agency Similar purpose 



Component/bureau - 
investment title 



Description 



FEA category 



Planned and 
reported 
spending 
fiscal years 
2008-2013 
(in millions) 



HHS Enterprise 

Information Security 



Centers for Medicare 
and Medicaid Services - 
The Center for 
Consumer Information & 
Insurance Oversight 
Enterprise IT Security 
Program 



This investment aims to maintain, Information and 

update, and institutionalize a Technology 
comprehensive IT security program. Management 



14.97 



Enterprise 
Information Security 



Indian Health Services 
IT Security Program 



This investment's goal is to create Information and 

information security policy and guidance, Technology 
manage centralized resources, and Management 
provide training for employees and 
contractors. 



37.02 



Enterprise 
Information Security 



Health Resources and 
Services Administration 
- Office of Information 
Technology Federal 
Information Systems 
Security Program 



This program is to provide IT security to Information and 
the component's IT infrastructure, major Technology 
applications, and all component Management 
information that is collected, processed, 
transmitted, stored, or disseminated. 



8.91 



Enterprise 
Information Security 



HHS - Secure One 



Secure One is an enterprisewide IT Information and 
security program designed to protect the Technology 
information and resources of HHS. Management 



195.69 



Medicare Coverage 
Determination 



Centers for Medicare 
and Medicaid Services - 
National Coverage 
Determination Database 



This database is to collect and 
disseminate all information collected 
during national coverage determinations 
for Medicare services via a web-based 
front-end search. 



Health 



0.83 



Medicare Coverage 
Determination 



Centers for Medicare 
and Medicaid Services - 
Local Coverage 
Determination Database 



This database is used to develop, 
maintain, access, and publish local 
coverage determinations for Medicare 
services. 



Health 



2.96 



Source: GAO analysis. 
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Appendix III: Comments from the 
Department of Defense 




DEPARTMENT OF DEFENSE 



6000 DEFENSE PENTAGON 
WASHINGTON. D.C. 20301-6000 



CHSFMFORMATIOH OFFICER 



AUG ^0 2013 



Mr. David Powncr 

Director. Information Technology Management Issues 
U.S. Government Accountability Office 
441 G Street, NW 
Washington, DC 20548 

Dear Mr. Povvner, 

This is a Department of Defense (DoD) response to the GAO draft Report, GAO- 
13-718. 'INFORMATION TECHNOLOGY: Key Federal Agencies Need to Address 
Potentially Duplicative Investments.' dated July 19. 2013 (GAO Code 31 1282). Detailed 
comments on the report recommendations are enclosed. 



Sincerely, 




Bonnie M. Hammersley U 
Deputy Chief Information Officer 
(Resources and Analysis) 



Enclosure: 
As stated 
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Appendix III: Comments from the Department 
of Defense 



GAO DRAFT REPORT DATED JULY 19, 2013 
GAO-13-718 (GAO CODE 311282) 

"INFORMATION TECHNOLOGY: KEY FEDERAL AGENCIES NEED TO ADDRESS 
POTENTIALLY DUPLICATIVE INVESTMENTS" 

DEPARTMENT OF DEFENSE COMMENTS 
TO THE GAO RECOMMENDATION 



RECOMMENDATION 1: The GAO recommends that the Secretary of Defense direct 
appropriate officials to: develop and document a plan on how the department intends to migrate 
it single dental system solution to all the services. 

DoD RESPONSE: DoD Concurs with recommendation. The Army and Air Force have 
transitioned to the Corporate Dental Application (CDA) and the Navy's requirements will be 
consolidated into CDA in fiscal year 20 1 5. Installation on the afloat units is based on the ships' 
Restricted Availability/Overhaul schedules and therefore Navy installation will not be totally 
completed until FY 2017. Dental Common Access System (DENCAS) will not be fully retired 
until CDA has been installed on all ships in FY 2017. 
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Appendix IV: Comments from the 
Department of Homeland Security 



I'.S. Depurfmeiil of Moiiu'lamt Smirit\ 
Washington, DC 20528 




% Homeland 
f Security 



August 20, 2013 



David A. Powner 

Director, Information Technology Management Issues 
U.S. Government Accountability Office 
441 G Street, NW 
Washington, DC 20548 

Re: Draft Report GAO-13-718, "INFORMATION TECHNOLOGY: Key Federal Agencies 
Need to Address Potentially Duplicative Investments" 

Dear Mr. Powner; 

Thank you for the opportunity to review and comment on this draft report. The U.S. Department of 
Homeland Security (DHS) appreciates the U.S. Government Accountability Office's (GAO's) work in 
planning and conducting its review and issuing this report. 

The Department is pleased to note GAO's positive acknowledgement that only 12 of the 590 
(2%) Information Technology (IT) investments examined at DHS, the Department of Defense, 
and Health and Human Services were potentially duplicative. DHS, however, does not agree 
with GAO's finding that there are two potentially duplicative investments that support 
immigration enforcement booking management. 

Specifically, U.S. Immigration and Customs Enforcement's (ICE's) ICE EAGLE and U.S. 
Customs and Border Protection's (CBP's) CBP E3 are customized applications with mission- 
specific workflows designed to meet the specific law enforcement mission needs of each 
Component. The CBP E3 workflows primarily focus on capturing apprehension enforcement 
actions for Border Patrol agents and CBP officers, whereas the ICE EAGLE workflows focus on 
capturing and processing of booking, identification, and subject information in support of 
investigations toward administrative and criminal arrests, as well as deportation proceedings. 
Neither application is duplicative of the other. 

The draft report contained three recommendations, one of w hich was directed to DHS and with 
which the Department non-concurs. Specifically, GAO recommended that the Secretary of 
Homeland Security direct appropriate officials to: 

Recommendation: Address the potentially duplicative investments identified in this report, 
including assessing the extent to which a single system could meet CBP and ICE immigration 
enforcement booking requirements. 



Page 24 



GAO-13-718 Information Technology 



Appendix IV: Comments from the Department 
of Homeland Security 



Response: Non-concur. The DHS Chief Enterprise Architect (EA) has previously reviewed the 
ICE EAGLE and CBP E3 investments and found that they are not duplicative. From an 
architectural perspective, they are considered one system that has two presentation and business 
logic layers to support the different missions of the two populations of law enforcement 
agents. Specifically, ICE EAGLE and CBP E3 are customized interface applications to a single, 
shared database in which the common data elements captured by the interfaces are stored. Using a 
single, shared database ensures the existence of a single source and storage place for the common 
data elements in order to eliminate - or at least to minimize - duplication of records. The interface 
applications are different because they were developed to effectively facilitate the mission-specific 
workflow processes of ICE and CBP agents. 

Annually, the DHS EA team, through the DHS Capital Planning and Investment Control process, 
has reviewed these investments and confirmed that they are not duplicative. DHS does not believe 
additional action in response to this recommendation is warranted and requests that the 
recommendation be considered resolved and closed. 

Again, thank you for the opportunity to review and provide comments on this draft report. 
Technical comments were previously provided under separate cover. Please feel free to contact 
me if you have any questions. We look forward to working with you in the future. 



Sincerely, 

\M^X 

Jim H. Crumpacker 
Director 

Departmental GAO-OIG Liaison Office 



2 
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Appendix V: GAO Contact and Staff 
Acknowledgments 



GAO Contact 



Staff 

Acknowledgments 



David A. Powner, (202) 512-9286 or pownerd@gao.gov 



In addition to the contact named above, individuals making contributions 
to this report included Gary Mountjoy (Assistant Director), Scott Borre, 
Rebecca Eyler, James MacAulay, and Teresa Smith. 



(311282) 
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GAO's Mission 



Obtaining Copies of 
GAO Reports and 
Testimony 
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Connect with GAO 

To Report Fraud, 
Waste, and Abuse in 
Federal Programs 

Congressional 
Relations 

Public Affairs 



The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting its 
constitutional responsibilities and to help improve the performance and 
accountability of the federal government for the American people. GAO 
examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding decisions. 
GAO's commitment to good government is reflected in its core values of 
accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's website (http://www.gao.gov). Each weekday 
afternoon, GAO posts on its website newly released reports, testimony, 
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The price of each GAO publication reflects GAO's actual cost of 
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Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 
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